Turla-English-CERTFR-2026-CTI-005.pdf

An inter-ministerial French report attributes longstanding espionage operations against French and allied targets to the Turla intrusion set run by the FSB's 16th Center (military unit 61240 among others). Active since at least 2004, Turla has used bespoke malware (Uroburos, Kazuar, ComRAT, etc.), open-source tools, satellite and compromised relay infrastructure, and diverse initial-access methods to compromise ministries, embassies, defense, justice and technology sector entities in France and Europe across multiple campaigns through 2025.